CVE-2023-39332

    Dashboard / Vulnerabilities / CVE-2023-39332

    CVE-2023-39332

    Published: 18 Oct 2023Last Modified: 28 Oct 2026

    Summary:

    Details: Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

    References: https://hackerone.com/reports/2199818, https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39332.json, https://nvd.nist.gov/vuln/detail/CVE-2023-39332, https://security.netapp.com/advisory/ntap-20231116-0009/, https://security.netapp.com/advisory/ntap-20241108-0002/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e7618fb5a5fc25d76b6474e2a6607f04fd6f10e0
    Fixed -a86c2caea9c329442bbbd8eeec6d5385b594b7ca

    Affected versions

    v20.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39332 | CVE-DB